Security audit
Security checks for vulnerabilities and agentic risk
This skill appears safe: it only drafts FreeLattice skill fields and, when possible, creates a minimal zip package for the user.
Before installing, understand that this skill is meant to generate skill-definition text and may create a small local zip package containing skill.json and README.md. Review generated prompts and triggers before importing them into FreeLattice, especially for overly broad trigger wording.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
This section: Input Template (Optional)
"..."
## Packaging Output Rules
If you can create files:
- create the zip and share it
- keep the package contents consistent with the displayed form fields
The instruction to 'Write triggers as natural user utterances' encourages broad, conversational trigger phrases without requiring specificity, scope limits, or negative examples. In a skill-definition context, this can lead to triggers that overlap with everyday speech and cause unintended invocation.
The skill requires emitting a file-by-file package block when artifacts are unavailable, but it places no practical bounds on the size of the generated system prompt, input template, or package contents. An attacker or careless user could induce extremely large outputs, causing token exhaustion, response truncation, or degraded service reliability.
- name the zip from the generated skill slug
If you cannot create files:
- append this exact additional section after the form-fill output:
This section: Package Files
"<file-by-file contents for the minimal FreeLattice zip package>"
The markdown instructs the skill to create a folder, write files, zip them, and provide the archive, but it does not warn users that local artifact creation and file writes may occur. Because these operations affect the runtime filesystem, the skill description should disclose that behavior to users.
No suspicious patterns detected.